Connected vehicles are routinely communicating with advertising, tracking and analytics companies, with some manufacturers’ apps transmitting information including vehicle identification numbers (VINs), email addresses and precise location data, according to new research.
Researchers from Northeastern University and nonprofit media organisation Consumer Reports examined 21 vehicles from 19 manufacturers and 30 associated mobile apps in the US.
The researchers routed vehicle internet traffic through networks they controlled to identify the domains contacted by the vehicles.
All 21 vehicles communicated with at least one third-party domain, while more than half contacted domains associated with advertising, tracking or analytics services.
However, much of the vehicle traffic was encrypted, meaning the researchers could generally identify the destination of communications but not their contents.
The companion mobile apps provided greater visibility into the data being transmitted. Seven apps – HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick and myGMC – were found to be sending personally identifiable information, including combinations of VINs, contact details and precise location data, to advertising or analytics services.
More than 70% of the apps tested contacted at least five advertising, tracking or analytics domains.
The research highlights the significance of the VIN as a persistent identifier linked to an individual vehicle. The researchers say combining it with information such as an email address or location could allow data about a vehicle and its use to be associated with other profiles held by advertising or data companies.
Northeastern said Adobe Analytics, Acxiom and Contentsquare were among the third parties contacted during the testing.
The study also found differences between vehicle manufacturers and software platforms. Vehicles using more extensively connected infotainment systems, including Google’s Android Automotive OS with Google Automotive Services, generally communicated with a greater number of third-party domains.
The researchers therefore suggest that data flows are influenced not only by manufacturers but also by the software and connected services integrated into vehicles.
Some manufacturers changed their practices after being presented with the findings.
Honda asked analytics provider Amplitude to delete location information it had received and subsequently updated the HondaLink app to stop transmitting geolocation data to the company.
Honda spokesperson Andrew Quillin confirmed the researchers’ account, saying the VIN and location data shared with Amplitude had not been available for the company’s independent use or sale because those activities were prohibited under its contractual agreement.
The research also points to the breadth of information that connected vehicles can generate and process.
Ford’s US privacy notice says connected Ford and Lincoln vehicles can wirelessly transmit vehicle-originated information to the company. General Motors says its connected services can collect precise geolocation and information about driving behaviour, including speed, braking and acceleration.
Honda’s privacy policy similarly covers vehicle identifiers, geolocation and information generated through its connected vehicle services.
The findings provide further evidence of the increasingly complex data flows behind connected vehicles and their companion apps, highlighting questions around how data generated by vehicles is shared with third parties and how clearly drivers are informed about those arrangements.
(Picture: Suwin Puensamrong)
